Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 725 | 0,2 % |
| ≥50 % | 3.222 | 0,9 % |
| ≥10 % | 22.088 | 5,9 % |
| <10 % | 347.078 | 93,0 % |
PHP warnt vor erneutem RCE: Ungewöhnliche Session-Upload-Progress-Setup-Variante
LONDON (IT BOLTWISE) – PHP meldet ein weiteres Risiko für RCE durch den Angriffsweg rund um PHP2Shell. Anders als bei den Notfall-Patches vom 21. Oktober betrifft die neue Schwachstelle (CVE-2026-115560) nur Webanwendungen mit einem ungewöh
CVE-2026-113401 | Mozilla Firefox up to 158.0.0 PDF Viewer denial of service (WID-SEC-2026-4064)
A vulnerability classified as problematic was found in Mozilla Firefox up to 158.0.0. Affected by this issue is some unknown functionality of the component PDF Viewer. Such manipulation leads to denial of service. This vulnerability is docu
CVE-2026-113400 | Mozilla Firefox up to 158.0.0 cubeb uninitialized pointer (WID-SEC-2026-4064)
A vulnerability classified as critical has been found in Mozilla Firefox up to 158.0.0. Affected by this vulnerability is an unknown functionality of the component cubeb. This manipulation causes uninitialized pointer. This vulnerability is
CVE-2026-113399 | Mozilla Firefox up to 158.0.0 SVG out-of-bounds (WID-SEC-2026-4064)
A vulnerability described as critical has been identified in Mozilla Firefox up to 158.0.0. Affected is an unknown function of the component SVG. The manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-11
CVE-2026-92745 | Red Hat Cockpit cockpit-machines getAccessToken invocation of process using visible sensitive information (Nessus ID 348655 / WID-SEC-2026-4118)
A vulnerability was found in Red Hat Cockpit. It has been declared as critical. This impacts the function getAccessToken of the component cockpit-machines. The manipulation results in invocation of process using visible sensitive informatio
CVE-2026-89320 | Eclipse KeyPont HmacShaCryptor.Hash data authenticity (EUVD-2026-108654)
A vulnerability was found in Eclipse KeyPont. It has been declared as problematic. Affected by this vulnerability is the function HmacShaCryptor.Hash. The manipulation results in insufficient verification of data authenticity. This vulnerab
CVE-2026-105963 | elixir-plug plug/plug_crypto Plug.Crypto.verify/Plug.Crypto.secure_compare information disclosure (EUVD-2026-108666)
A vulnerability labeled as problematic has been found in elixir-plug plug and plug_crypto. This issue affects the function Plug.Crypto.verify/Plug.Crypto.secure_compare of the component plug_crypto. Executing a manipulation can lead to info
CVE-2026-114406 | Red Hat Satellite 6 ca-certificates certificate validation (EUVD-2026-107565)
A vulnerability was found in Red Hat Advanced Cluster Management for Kubernetes, Advanced Cluster Security, Assisted Installer for OpenShift Container Platform, cert-manager Operator for OpenShift, Confidential Compute Attestation, Connecti
CVE-2026-91403 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JSSE privileges management (EUVD-2026-107578)
A vulnerability classified as critical has been found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition up to 27.0.1. This issue affects some unknown processing of the component JSSE. This manipulation causes improper privil
CVE-2026-94263 | Advanced Custom Fields Extended Plugin up to 0.9.2.7 on WordPress Shortcode injection (EUVD-2026-108668)
A vulnerability described as critical has been identified in Advanced Custom Fields Extended Plugin and Advanced Custom Fields Extended PRO Plugin up to 0.9.2.7 on WordPress. The affected element is an unknown function of the component Shor
CVE-2026-111965 | Profile Builder Plugin up to 4.0.4 on WordPress reCAPTCHA Verification protection mechanism (EUVD-2026-108667)
A vulnerability marked as problematic has been reported in Profile Builder Plugin up to 4.0.4 on WordPress. Impacted is an unknown function of the component reCAPTCHA Verification. The manipulation leads to protection mechanism failure. Thi
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. This article has been indexed from SecurityWeek Read the original article: Attackers Exploit Third VeloCloud
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which i
[NEU] [niedrig] KNIME Analytics Platform: Schwachstelle ermöglicht Offenlegung von Informationen
Ein lokaler Angreifer kann eine Schwachstelle in KNIME Analytics Platform ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [mittel] Livewire: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Livewire ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
[NEU] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Oracle Java SE, Oracle GraalVM und OpenJDK ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Daten offenzulegen oder zu verändern. Weiterlesen
[NEU] [hoch] TianoCore EDK2 PXE Treiber: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode und DoS
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in TianoCore EDK2 ausnutzen, um beliebigen Programmcode mit Ring-0-Rechten auszuführen oder einen Denial-of-Service-Zustand zu verursachen. Weiterlesen
[NEU] [mittel] MongoDB C Treiber: Schwachstelle ermöglicht Denial of Service und manipulation von Daten
Ein lokaler Angreifer kann eine Schwachstelle in MongoDB C Treiber ausnutzen, um einen Denial of Service Angriff durchzuführen, und um Daten zu manipulieren. Weiterlesen
[NEU] [mittel] OpenProject: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenProject ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [niedrig] IBM SPSS Modeler: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM SPSS ausnutzen, um Dateien zu manipulieren. Weiterlesen
[NEU] [mittel] OpenVPN 3 Core Library: Schwachstelle ermöglicht Offenlegung von Informationen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenVPN 3 Core Library ausnutzen, um Informationen offenzulegen. Weiterlesen
[NEU] [kritisch] Arista VeloCloud Orchestrator: Schwachstelle ermöglicht SQL-Injection und potenziell Privilegieneskalation
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Arista VeloCloud Orchestrator ausnutzen, um einen SQL-Injection Angriff durchzuführen und potenziell um seine Privilegien zu erhöhen. Weiterlesen
[NEU] [UNGEPATCHT] [mittel] expat: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
CVE-2026-112821 | Knit Pay Plugin up to 9.6.3.0 on WordPress missing authentication (EUVD-2026-108624)
A vulnerability was found in Knit Pay Plugin up to 9.6.3.0 on WordPress. It has been rated as critical. The affected element is an unknown function. Performing a manipulation results in missing authentication. This vulnerability is reported
CVE-2026-112359 | Amauri.IO WPMobile.App Plugin up to 11.86 on WordPress missing authentication (EUVD-2026-108626)
A vulnerability, which was classified as problematic, was found in Amauri.IO WPMobile.App Plugin up to 11.86 on WordPress. Affected by this issue is some unknown functionality. Executing a manipulation can lead to missing authentication. Th
CVE-2026-25784 | Hallo Welt! BlueSpice up to 5.2.6 Token Authenticator LocalSettings.php mwsgTokenAuthenticatorServiceCIDR default permission (EUVD-2026-108653)
A vulnerability classified as critical was found in Hallo Welt! BlueSpice up to 5.2.6. Impacted is an unknown function of the file LocalSettings.php of the component Token Authenticator. The manipulation of the argument mwsgTokenAuthenticat
CVE-2026-25716 | Hallo Welt! BlueSpice up to 5.1.10/5.2.6 UserManager create unblockUser improper authorization (EUVD-2026-108651)
A vulnerability, which was classified as problematic, has been found in Hallo Welt! BlueSpice up to 5.1.10/5.2.6. The affected element is the function UserManager::blockUser/UserManager::unblockUser of the file /bs-usermanager/v1/block/crea
CVE-2026-112838 | e4jvikwp VikRentCar Plugin up to 1.4.8 on WordPress cross site scripting (EUVD-2026-108625)
A vulnerability labeled as problematic has been found in e4jvikwp VikRentCar Plugin up to 1.4.8 on WordPress. This impacts an unknown function. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-112838
CVE-2026-16762 | Qt up to 4.2.x/6.8.8/6.11.1 QXmlStreamReader denial of service (EUVD-2026-108655)
A vulnerability was found in Qt up to 4.2.x/6.8.8/6.11.1. It has been classified as problematic. Affected is an unknown function of the component QXmlStreamReader. The manipulation leads to denial of service. This vulnerability is listed as
[NEU] [mittel] Qt Core QXmlStream parser: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Qt Core QXmlStream parser ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [mittel] Red Hat Enterprise Linux iperf3: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux iperf3 ausnutzen, um einen Denial of Service Angriff durchzuführen. Weiterlesen
[NEU] [UNGEPATCHT] [hoch] rsyslog: Schwachstelle ermöglicht Manipulation von Dateien
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rsyslog ausnutzen, um Dateien zu manipulieren. Weiterlesen
[NEU] [mittel] Red Hat Enterprise Linux ca-certificates: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ca-certificates ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen auszulesen oder Daten zu manipulieren Weiterlesen
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Public proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively ca
CVE-2026-112837 | Ruben Garcia GamiPress Plugin up to 8.0.7 on WordPress sql injection (EUVD-2026-108627)
A vulnerability has been found in Ruben Garcia GamiPress Plugin up to 8.0.7 on WordPress and classified as critical. This affects an unknown part. The manipulation leads to sql injection. This vulnerability is listed as CVE-2026-112837. The
CVE-2026-112835 | e4jvikwp VikRentCar Plugin up to 1.4.8 on WordPress cross site scripting (EUVD-2026-108628)
A vulnerability identified as problematic has been detected in e4jvikwp VikRentCar Plugin up to 1.4.8 on WordPress. This affects an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-1
CVE-2026-112862 | Xnau Webdesign Participants Database Plugin up to 2.7.8.5 on WordPress deserialization (EUVD-2026-108629)
A vulnerability categorized as critical has been discovered in Xnau Webdesign Participants Database Plugin up to 2.7.8.5 on WordPress. The impacted element is an unknown function. Executing a manipulation can lead to deserialization. This v
CVE-2026-115657 | KNIME Analytics Platform up to 5.8.x/5.11.x Proxy Configuration information disclosure (EUVD-2026-108631)
A vulnerability was found in KNIME Analytics Platform up to 5.8.x/5.11.x. It has been declared as problematic. Impacted is an unknown function of the component Proxy Configuration. Such manipulation leads to information disclosure. This vul
CVE-2026-112860 | Xnau Webdesign Participants Database Plugin up to 2.7.8.5 on WordPress sql injection (EUVD-2026-108630)
A vulnerability was found in Xnau Webdesign Participants Database Plugin up to 2.7.8.5 on WordPress. It has been classified as critical. This issue affects some unknown processing. This manipulation causes sql injection. This vulnerability
CVE-2026-96293 | WatchGuard Agent 1.17.24.0000 Full Disk Encryption cleartext storage (EUVD-2026-108073)
A vulnerability was found in WatchGuard Agent 1.17.24.0000. It has been rated as problematic. This affects an unknown part of the component Full Disk Encryption. Performing a manipulation results in cleartext storage of sensitive informatio
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWe
CVE-2026-74534 | Linux Kernel up to 6.18.43/7.1.7/7.2-rc5 Bluetooth iso_conn_del/iso_chan_del use after free (EUVD-2026-59727 / Nessus ID 335840)
A vulnerability was found in Linux Kernel up to 6.18.43/7.1.7/7.2-rc5. It has been rated as very critical. This issue affects the function iso_conn_del/iso_chan_del of the component Bluetooth. The manipulation leads to use after free. This
CVE-2025-30043 | CGM CLININET up to 2026.MS2 missing authentication (EUVD-2025-211175)
A vulnerability was found in CGM CLININET up to 2026.MS2. It has been classified as problematic. The impacted element is an unknown function. Performing a manipulation results in missing authentication. This vulnerability is cataloged as CV
CVE-2025-30046 | CGM CLININET up to 2026.MS3 HL7 Communication privileges management (EUVD-2025-211177)
A vulnerability, which was classified as very critical, has been found in CGM CLININET up to 2026.MS3. This vulnerability affects unknown code of the component HL7 Communication. The manipulation leads to improper privilege management. This
CVE-2025-30045 | CGM CLININET up to 2026.MS3 ConvExpr code injection (EUVD-2025-211176)
A vulnerability was found in CGM CLININET up to 2026.MS3 and classified as very critical. The affected element is the function ConvExpr. Such manipulation leads to code injection. This vulnerability is listed as CVE-2025-30045. The attack m
CVE-2025-30050 | CGM CLININET up to 2026.MS2 RunCGI RunCGI.pm os command injection (EUVD-2025-211180)
A vulnerability was found in CGM CLININET up to 2026.MS2. It has been rated as very critical. This impacts an unknown function of the file RunCGI.pm of the component RunCGI. The manipulation leads to os command injection. This vulnerability
CVE-2025-30049 | CGM CLININET up to 2026.MS3 weak password hash (EUVD-2025-211179)
A vulnerability described as problematic has been identified in CGM CLININET up to 2026.MS3. This vulnerability affects unknown code. Executing a manipulation can lead to password hash with insufficient computational effort. This vulnerabil
CVE-2025-30047 | CGM CLININET up to 2026.MS2 deserialization (EUVD-2025-211178)
A vulnerability has been found in CGM CLININET up to 2026.MS2 and classified as very critical. Impacted is an unknown function. This manipulation causes deserialization. This vulnerability is tracked as CVE-2025-30047. The attack is possibl
CVE-2025-30051 | CGM CLININET up to 2026.MS2 Configuration File SysIO.pl permission (EUVD-2025-211181)
A vulnerability marked as problematic has been reported in CGM CLININET up to 2026.MS2. This affects an unknown part of the file SysIO.pl of the component Configuration File. Performing a manipulation results in permission issues. This vuln
CVE-2026-112998 | Google Chrome up to 155.0.8059.84 Views memory corruption (WID-SEC-2026-4067)
A vulnerability categorized as critical has been discovered in Google Chrome. Affected by this vulnerability is an unknown functionality of the component Views. The manipulation results in memory corruption. This vulnerability is known as C
CVE-2026-112997 | Google Chrome up to 155.0.8059.84 CSS memory corruption (WID-SEC-2026-4067)
A vulnerability was found in Google Chrome. It has been rated as critical. Affected is an unknown function of the component CSS. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2026-112997. It is possible to
[UPDATE] [mittel] Mozilla Firefox: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Mozilla Firefox ausnutzen, um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
CVE-2025-30053 | CGM CLININET up to 2026.MS3 missing authentication (EUVD-2025-211183)
A vulnerability categorized as critical has been discovered in CGM CLININET up to 2026.MS3. Affected is an unknown function. The manipulation results in missing authentication. This vulnerability is reported as CVE-2025-30053. The attack ca
CVE-2025-30052 | CGM CLININET up to 2026.MS3 rsyncd service improper authentication (EUVD-2025-211182)
A vulnerability was found in CGM CLININET up to 2026.MS3. It has been declared as critical. This affects an unknown function of the component rsyncd service. Executing a manipulation can lead to improper authentication. This vulnerability i
CVE-2026-89312 | Google Go GCM AesGcmCryptor.Open nonce input validation (EUVD-2026-108632)
A vulnerability labeled as problematic has been found in Google Go. Affected by this issue is the function AesGcmCryptor.Open of the component GCM. Such manipulation of the argument nonce leads to improper input validation. This vulnerabili
CVE-2025-58403 | CGM CLININET up to 2026.MS3 cross site scripting (EUVD-2025-211185)
A vulnerability classified as problematic has been found in CGM CLININET up to 2026.MS3. This issue affects some unknown processing. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-58403
CVE-2025-30054 | CGM Clininet up to 2026.MS3 privileges management (EUVD-2025-211184)
A vulnerability, which was classified as very critical, was found in CGM Clininet up to 2026.MS3. This issue affects some unknown processing. The manipulation results in improper privilege management. This vulnerability is identified as CVE
CVE-2026-89313 | Eclipse KeyPont JWKS Cache JwksTrustStore.Get kid return value (EUVD-2026-108633)
A vulnerability identified as critical has been detected in Eclipse KeyPont. Affected by this vulnerability is the function JwksTrustStore.Get of the component JWKS Cache. This manipulation of the argument kid causes unchecked return value.
CVE-2022-47630 | Trusted Firmware-A up to 2.8 X.509 Parser out-of-bounds (EUVD-2022-50390)
A vulnerability was found in Trusted Firmware-A up to 2.8. It has been declared as problematic. Affected is an unknown function of the component X.509 Parser. The manipulation results in out-of-bounds read. This vulnerability was named CVE-
CVE-2022-47618 | Merit LILIN AH55B04/LILIN AH55B08 hard-coded credentials (EUVD-2022-50378)
A vulnerability described as critical has been identified in Merit LILIN AH55B04 and LILIN AH55B08. This affects an unknown function. The manipulation results in hard-coded credentials. This vulnerability is identified as CVE-2022-47618. Th